The JoomSky JS Help Desk WordPress plugin contains an Authorization Bypass through User‑Controlled Key flaw, which permits an attacker to reference tickets belonging to other users by manipulating a key value. This insecure direct object reference undermines confidentiality and integrity, as unauthorized users may view or modify tickets that do not belong to them. The weakness is classified as CWE‑639.

Affected systems include installations of the JS Help Desk WordPress plugin from any version up to and including 3.0.3. The issue is present in all releases before that version, with the exact edition unspecified beyond the upper bound. No later versions are listed as vulnerable.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, over the web, by sending crafted HTTP requests that supply a manipulated key to the plugin’s endpoints. Exploitation would require either authenticated access or the ability to guess valid key values.